前后端BFF网关安全模式（会话代理/令牌封装）最佳实践

背景与价值直接在前端存储访问令牌存在风险。BFF通过服务端封装令牌并以HttpOnly Cookie维持会话，降低泄露面。统一规范HttpOnly Cookie：前端仅持有会话标识，不持有访问令牌。令牌封装：网关以后端到后端模式携带令牌调用下游。会话存储：令牌与权限数据存储在服务端，按会话ID映射。核心实现会话与令牌映射type Sess = { id: string; userId: string; createdAt: number } type TokenInfo = { accessToken: string; exp: number; scope: string } class Store { sess = new Map<string, Sess>() token = new Map<string, TokenInfo>() // key: session id now(): number { return Date.now() } create(userId: string): Sess { const s: Sess = { id: Math.random().toString(36).slice(2), userId, createdAt: this.now() }; this.sess.set(s.id, s); return s } bind(sessId: string, t: TokenInfo) { this.token.set(sessId, t) } getToken(sessId: string): TokenInfo | undefined { const t = this.token.get(sessId); if (!t) return; if (t.exp * 1000 < this.now()) return; return t } } 网关封装调用type Req = { cookies: Record<string, string | undefined>; path: string } type Res = { setHeader: (k: string, v: string) => void; status: (n: number) => Res; end: (b?: string) => void } function setSessCookie(res: Res, id: string) { res.setHeader('Set-Cookie', `sid=${id}; Path=/; HttpOnly; Secure; SameSite=Lax`) } async function proxy(req: Req, res: Res, store: Store): Promise<void> { const sid = req.cookies['sid'] const t = sid ? store.getToken(sid) : undefined if (!t) { res.status(401).end('unauthorized'); return } res.setHeader('X-Auth-Forwarded', 'true') res.end(JSON.stringify({ ok: true, path: req.path, scope: t.scope })) } 落地建议使用BFF网关以HttpOnly Cookie维持会话，令牌仅存在服务端，避免浏览器泄露。对下游调用统一封装并审计，按会话ID检索令牌与权限细节。验证清单会话Cookie是否为HttpOnly/Secure/SameSite；令牌是否仅在服务端存储与封装调用。